Partnered With:

Nexus Mutual founder's own handwriting: 370,000 NXM tokens were stolen by hackers

Read this article in 14 Minutes

Hugh Karp, founder of Nexus Mutual, personally described the process and progress of the stolen 370,000 NXM tokens.

Original author: Hugh Karp, founder of Nexus Mutual

Original source: Lianwen

Editor Note: If there is any further information update, the content of this article will be adjusted in due course.

Time background

world standard At 9:40 AM on Monday, December 14th, I was tricked into approving a transaction for a total of 370,000 NXM tokens. I thought the transaction was my own mining reward money, but it turned out to be sent directly to the hacker, who then liquidated the stolen NXM tokens into Bitcoin and Ethereum, and then distributed the funds to Different addresses and exchanges.

Nexus Mutual founder's handwriting: 370,000 NXM tokens were stolen by hackers

I was using a link to Ledger The Metamask wallet interacts through the Nexus Mutual application. The computer is a Windows operating system. The private key on the Ledger is currently safe, and the Nexus Mutual smart contract and funds have not been affected, so basically it can be judged that this should be just a personal attack.

The plot of the incident so far

In this targeted Here's what we know about the attack:

Friday Dec 11 around 10:20 UTC I was writing an email, Suddenly the computer screen went black for 2-3 seconds, but it came back on quickly, at the time I thought maybe there was just something weird going on with the computer, so didn't pay much attention.

About an hour later, at around 11:20 UTC on Friday 11 December, my disk was infected with a hacked version of the Metamask wallet extension replaced. Details can be found here and the background.js file.

I actually didn't trade cryptocurrencies through the Metamask wallet extension until Monday, December 14th.

Monday December 14th at 9:40 AM UTC, I wanted to go to the Nexus Mutual app to withdraw some tokens for the mining rewards. As usual, MetaMask pops up the withdrawal application confirmation message, which is not surprising, because every transaction will pop up a confirmation message, and everything looks normal. But the problem is that this confirmation contains a fraudulent transaction sent to Ledger. As a result, I clicked "Confirm".

The transaction quickly appeared on Ledger, I checked the transaction information and clicked "Approve". In fact, if I check the "recipient" address and other transaction information at this time, I may find the problem. However, since Ledger does not directly support NXM, the transaction information does not include the recipient and other relevant information by default. read information.

Then, I got a notification from MetaMask that the transaction was completed, but the Nexus Mutual app was still waiting to confirm the transaction, at which point I realized something was wrong, So I checked Etherscan and it turned out that the money went to the hacker's address.

Looking back, the place where I made a mistake occurred in the fifth step above. I should be more careful when trading. It can be said that this hacker theft is entirely my own Responsibility. But I want to point out that unless you are a person who is very familiar with encryption technology, it is difficult to carefully check the relevant information when transferring funds. After all, the information in hexadecimal format is difficult to read. Personally, I myself actually have enough technical knowledge to understand what these messages mean, but I still make mistakes, so ordinary users can easily stumble here.

In addition, I have been getting cryptocurrency reward tokens from websites I trust, such as Nexus Mutual APP, because I feel that trading on the official platform is more risky However, from this hacking incident, it is found that no matter whether it is a trusted site or not, and no matter how much the transaction value is, the information must be carefully checked every time before confirming the transaction.

Now, I plan to start investigating this hack and trace the funds with the help of the community, thank you for your support! Here, I would like to thank many people for their support, especially Sergej Kunz, Jpien Bouteloup, Harry Sniko, Richard Chen, Banteg, and some others whose names I am not comfortable to disclose at this time.

Summary of Findings

In the past, most MetaMask hacks have been It is to lure users to download a fake program version containing malicious code, and then steal the user's private key. But this time the situation is different. My computer was corrupted, and the MetaMask application on disk had been tampered with, which meant no warning message would appear when there was a problem with the browser extension.

According to our understanding, this malicious extension configuration was obtained from coinbene.team, and we traced some IP addresses from this domain name, as shown in the figure below:

Nexus Mutual founder handwritten: 370,000 NXM tokens were stolen by hackers

My browser has entered developer mode, but I Not a developer, so this action was most likely performed by a hacker.

We have found and contacted other victims who were similarly attacked.

This attack appears to be highly targeted as the hackers did not take all the NXM tokens the victim might have, so it appears the hackers have specifically targeted A pre-prepared transaction load is deployed.

I will list the most relevant hacker addresses below:

Ethereum :

0xad6a4ace6dcc21c93ca9dbc8a21c7d3a726c1fb1

0x03e89f2e1ebcea5d94c1b530f638cea3950c2e2b

0x09923e35f19687a524bbca7d42b92b6748534f25

0x0784051d5136a5ccb47ddb3a15243890f5268482

0x0adab459 46372c2be1b94eead4b385210a8ebf0b

Bitcoin:

3DZTKLmxo56JXFEeDoKU8C4Xc37ZpNqEZN

Messaging (?) Channel

0x756c4628e57f7e7f8a459ec2752968360cf4d1aa

What else do we not know?

First of all, I don't know how my computer was compromised.

Over the past week I have spent a lot of time with experts from antivirus provider Kaspersky on infected computers allowing a full diagnostic procedure, But nothing has come out yet, and the work is still a work in progress.

Who are the hackers?

From what we have seen so far, this hacker is very powerful, but it also shows that attacks are likely to continue and affect more and more people. It can be said that this hacker is very talented and is likely to be one or more members from a large technical team. We had a brief conversation with a hacker on Telegram who we believe to be in an Asian time zone based on their trading activity.

At present, the investigation is still going on, if there is any available information, we will share and release it in time.

Lesson learned

Some users who are more familiar with the DeFi industry They don’t always trust MetaMask very much. They even take out a “clean” computer to run MetaMask. This device is only used to sign transactions and does nothing else.

MetaMask is indeed the target of many hackers, so I have been very cautious about downloading programs from legitimate sources, but even so, my computer was infected. If you want to avoid such problems, you can try to allocate funds to different accounts, which can minimize losses. Also, be sure to check your hardware wallet for transactions before signing (easier said than done, especially when interacting with smart contracts).

So far, we have not had open source intelligence about the hacker, but the hacker address has been marked on Etherscan, although this is a step in the investigation An important step, but there are still many things to deal with in the follow-up.

What's next?

I know there are a lot of teams looking for the best deal options from both a user experience and security standpoint, but as a community we're obviously still a little bit off on that front There is a long way to go. I can't recommend another solution, but I will take a portion of the funds raised and donate it as a bounty to support user experience and security improvements.

We will announce the details of the bounty in the future. I believe this will encourage more people to develop personal wallet security solutions and promote technological progress.

An Open Letter to Hackers

You use very sophisticated techniques , not only stole funds from me, but also stole a lot of money from many others in the Ethereum community. I understand that you have sent some of the funds to the boss behind the scenes, so I have given up on getting this money back.

As you know, there are many white hat hackers in the Ethereum community who work anonymously, are rewarded handsomely through bounties, and because Some great work has made a name for itself in circles. Based on the skills you've demonstrated, I think you could be a white hat hacker, so you can make money legally without sending ill-gotten gains to the bosses behind the scenes.

I think you can put the skills you have acquired to good use and get some credit from the crypto community for the right reasons.